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CLAIMS : 

What is claimed is: 

1. A method for filtering content, comprising: 

5 assigning point values to a plurality of keywords; 

receiving a first plurality of documents from a 
source; 

comparing text of each of the first plurality of 
documents with the plurality of keywords; 
10 calculating a score for each of the first plurality 

of documents based on the point values and the results of 
the comparison; 

calculating an first average of the scores for the 
first plurality of documents; and 
15 blocking access to the source if the first average 

score exceeds a threshold. 

2. The method of claim 1, wherein the keywords and 
corresponding point values are stored in a keyword search 

20 table. 

3. The method of claim 1, wherein the step of blocking 
access to the source comprises entering a known -block 
rule in a rules table, the known -block rule indicating 

25 that the source is to be blocked. 

4. The method of claim 1, further comprising: 
entering a known- safe rule in a rules table if the 

first average score does not exceed the threshold, the 
30 known- safe rule indicating that access to the source is 
to be permitted. 
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5. The method of claim 1, further comprising: 

if the first average score does not exceed the 
threshold, performing the following steps: 
5 receiving a second plurality of documents from 

a source; 

comparing text of each of the second plurality 
of documents with the plurality of keywords; 

calculating a score for each of the second 
10 plurality of documents based on the point values and 

the results of the comparison; 

calculating an second average of the scores for 
the second plurality of documents; and 

blocking access to the source if the second 
15 average score exceeds a threshold, 

6, The method of claim 1, wherein the method is 
performed in a firewall. 

20 7. A method for filtering content, comprising: 

assigning point values to a plurality of keywords; 

receiving a request for a document from a client; 

receiving the document from a source; 

comparing text of each of the plurality of documents 
25 with the plurality of keywords; 

calculating a score for the document based on the 
point values and the results of the comparison; 

determining if a decision interval has been reached; 

calculating an average score over the decision 
30 interval if the decision interval has been reached for 
the source; and 
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blocking access to the source if the average score 
exceeds a threshold. 

8. The method of claim 7, wherein the keywords and 

5 corresponding point values are stored in a keyword search 
table. 

9. The method of claim 7, wherein the decision interval 
is a length of time. 

10 

10. The method of claim 7, wherein the decision interval 
is a number of documents . 

11. The method of claim 7, wherein the step of blocking 
15 access to the source comprises entering a known-block 

rule in a rules table, the known -block rule indicating 
that the source is to be blocked. 

12. The method of claim 7, further comprising: 

20 entering a known- safe rule in a rules table if the 

first average score does not exceed the threshold, the 
known- safe rule indicating that access to the source is 
to be permitted. 

25 13. The method of claim 7, further comprising: 

passing the document to the client if the decision 
interval has not been reached. 
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14. The method of claim 7, further comprising: 

passing the document to the client if the first 
average score does not exceed the threshold. 
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15. An apparatus for filtering content, comprising: 

assignment means for assigning point values to a 
plurality of keywords; 
5 receipt means for receiving a first plurality of 

documents from a source; 

comparison means for comparing text of each of the 
first plurality of documents with the plurality of 
keywords ; 

10 calculation means for calculating a score for each 

of the first plurality of documents based on the point 
values and the results of the comparison; 

averaging means for calculating an first average of 
the scores for the first plurality of documents; and 
iji. 15 blocking means for blocking access to the source if 

S the first average score exceeds a threshold. 

N= 16. The apparatus of claim 15, wherein the keywords and 

[I corresponding point values are stored in a keyword search 

[U 20 table. 

17. The apparatus of claim 15, wherein the blocking 
means comprises means for entering a known-block rule in 
a rules table, the known-block rule indicating that the 

25 source is to be blocked. 

18. The apparatus of claim 15, further comprising: 
means for entering a known- safe rule in a rules 

table if the first average score does not exceed the 
30 threshold, the known- safe rule indicating that access to 
the source is to be permitted. 
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19. The apparatus of claim 15, wherein the apparatus is 
in a firewall. 

5 20. An apparatus for filtering content, comprising: 
assignment means for assigning point values to a 
plurality of keywords; 

first receipt means for receiving a request for a 
document from a client; 
10 second receipt means for receiving the document from 

a source; 

comparison means for comparing text of each of the 
plurality of documents with the plurality of keywords; 

calculation means for calculating a score for the 
15 document based on the point values and the results of the 
comparison; 

determination means for determining if a decision 
interval has been reached; 

averaging means for calculating an average score 
20 over the decision interval if the decision interval has 
been reached for the source; and 

blocking means for blocking access to the source if 
the average score exceeds a threshold. 

25 21. The apparatus of claim 20, wherein the keywords and 
corresponding point values are stored in a keyword search 
table. 

22. The apparatus of claim 20, wherein the decision 
30 interval is a length of time. 



Docket No. AUS920000767US1 



23. The apparatus of claim 20, wherein the decision 
interval is a number of documents. 

24. The apparatus of claim 20, wherein the blocking 

5 means comprises means for entering a known -block rule in 
a rules table, the known -block rule indicating that the 
source is to be blocked. 

25. The apparatus of claim 20, further comprising: 
10 means for entering a known- safe rule in a rules 

table if the first average score does not exceed the 
threshold, the known- safe rule indicating that access to 
the source is to be permitted. 

15 26. The apparatus of claim 20, further comprising: 

means for passing the document to the client if the 
decision interval has not been reached. 

27. The apparatus of claim 20, further comprising: 

20 means for passing the document to the client if the 

first average score does not exceed the threshold. 

28. A computer program product, in a computer readable 
medium, for filtering content, comprising: 

25 instructions for assigning point values to a 

plurality of keywords; 

instructions for receiving a first plurality of 
documents from a source; 

instructions for comparing text of each of the first 
30 plurality of documents with the plurality of keywords; 

instructions for calculating a score for each of the 
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first plurality of documents based on the point values 
and the results of the comparison; 

instructions for calculating an first average of the 
scores for the first plurality of documents; and 
5 instructions for blocking access to the source if 

the first average score exceeds a threshold. 

29. A computer program product, in a computer readable 

medium, for filtering content, comprising: 
10 instructions for assigning point values to a 

plurality of keywords; 

instructions for receiving a request for a document 

from a clients- 
instructions for receiving the document from a 

15 source; 

instructions for comparing text of each of the 
plurality of documents with the plurality of keywords; 

instructions for calculating a score for the 
document based on the point values and the results of the 
20 comparison; 

instructions for determining if a decision interval 
has been reached; 

instructions for calculating an average score over 
the decision interval if the decision interval has been 
25 reached for the source; and 

instructions for blocking access to the source if 
the average score exceeds a threshold. 



